android: the handoff — the pending rounds, the pipeline, and what is unverified

Everything written this session that has not been through the device: rounds 43
to 48 (each patch adversarially verified, 43's transient-notice expectation
fixed), a partial round 49, the pipeline scripts, the Android Auto design and
the icon comparison mock. Also the two harness changes that were never A/B'd —
adaptive waits, which may only shorten a declared wait and never lengthen it,
and a ship that runs the mock walk and the deploy at the same time. The A/B and
its 255-step baseline are in handoff/tools; main stays at what the phone has
actually walked.

handoff/rounds/ins-r32-mobile-seal.txt

@@ -0,0 +1,13 @@
+        /* everything above went out in this one turn. A call that waits on
+           the one before it can only have issued its first here, so this is
+           the number that says the boot chain is still going out in one
+           round — 10 before this round, 23 after it — and the walk holds a
+           floor against it. */
+        boot.sync = boot.calls;
+        /* two frames: the first is the shell, the second is the first one
+           the app could have drawn anything into. A phone producing no
+           frames at all (launched straight into the background) seals on
+           the timer instead, well before the walk's first probe — the
+           census must never depend on something that might not happen. */
+        const sealTimer = setTimeout(sealBoot, 1200);
+        requestAnimationFrame(() => requestAnimationFrame(() => { clearTimeout(sealTimer); sealBoot(); }));